noob sql C# problem

[pinman]

hi. i'm pretty much a noob to c# and visual studio and am trying to create a simple login method. i have created a users table in the database and can add users by inputing there md5 encrypted password and a non encrypted username. problem is then checking a user has inputed valid username and passwords. i've created a stored procedure that returns 1 for a valid login and 0 for invalid but don't know if this procedure is the problem

PROCEDURE validlogin
        @uname nchar(30),
        @pass nchar(100),
        @valid int        OUTPUT
AS
    IF EXISTS(SELECT * FROM Users WHERE User_name = @uname AND Password = @pass)
        SELECT @valid = 1
    ELSE
        SELECT @valid = 0
    RETURN @valid
 

this next method then takes the data from the login page and runs the stored procedure after this it returns true or false to another method which will handle what to do next.

private bool UserAuthenticate(string uname, string pass)
        {
            int validateresult;
            string hashedpwd = EncodePassword(pass);
            //query the username and password
            sqlSelectCommand1.CommandType = CommandType.StoredProcedure;
            sqlSelectCommand1.CommandText = "validlogin";
            sqlSelectCommand1.Parameters.Add(new SqlParameter("@uname", SqlDbType.NChar, 30));
            sqlSelectCommand1.Parameters["@uname"].Value = uname;
            sqlSelectCommand1.Parameters.Add(new SqlParameter("@pass", SqlDbType.NChar, 30));
            sqlSelectCommand1.Parameters["@pass"].Value = hashedpwd;
            sqlSelectCommand1.Parameters.Add(new SqlParameter("@valid", SqlDbType.NChar, 30));
            sqlSelectCommand1.Parameters["@valid"].Direction = ParameterDirection.Output;
            //sqlDataAdapter1.SelectCommand = sqlSelectCommand1;
            sqlConnection1.Open();
 
            validateresult = Convert.ToInt32(sqlSelectCommand1.ExecuteScalar());
            sqlConnection1.Close();
            if (validateresult == 1)
            {
                return true;
            }
            else
            {
                return false;
            }
}

any help would be much appreciated

[pinman]

god only knows why but the code seems to now work after i took a break and re-ran the program. one thing i did change was change SELECT @valid = 1 to SET @valid = 1 in the stored procedure, but i then changed it back and it worked both ways. so the result from the stored procedure is 0 or 1 depending if the correct data has been entered. next question is where next. i think i have options of creating a cookie on users machine or using session variables? any other ways to proceed? any way that code could be improved? (including how to put in error handling)
thanks in advance

[Curtis Rutland]

Well, just some pointers on making it cleaner. You can use SqlCommand.Para meters.AddWithV alue(string param, object value) instead of Add, which should condense things a bit. Also, you should be able to cast the return value of ExecuteScalar as a bool rather than an int.

Just little things. Your way isn't wrong, just different than mine.

Also, please use [code] tags when posting code. You can use the # symbol in the text editor.

Mod.